dylan.derr/Send
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

updated filelist storage so userid is not used directly

Browse source
This commit is contained in:
Danny Coates 2019-02-26 13:53:11 -08:00
parent d55f0247de
commit 4cb6646cce
No known key found for this signature in database
GPG key ID: 4C442633C62E00CB
4 changed files with 24 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

15
server/routes/filelist.js
View file

@ -1,9 +1,14 @@
const crypto = require('crypto');
const config = require('../config');
const storage = require('../storage');
const Limiter = require('../limiter');
function id(user) {
return `filelist-${user}`;
function id(user, kid) {
const sha = crypto.createHash('sha256');
sha.update(user);
sha.update(kid);
const hash = sha.digest('hex');
return `filelist-${hash}`;
}
module.exports = {
@ -11,8 +16,9 @@ module.exports = {
if (!req.user) {
return res.sendStatus(401);
}
const kid = req.params.id;
try {
const fileId = id(req.user);
const fileId = id(req.user, kid);
const contentLength = await storage.length(fileId);
const fileStream = await storage.get(fileId);
res.writeHead(200, {
@ -29,11 +35,12 @@ module.exports = {
if (!req.user) {
return res.sendStatus(401);
}
const kid = req.params.id;
try {
const limiter = new Limiter(1024 * 1024 * 10);
const fileStream = req.pipe(limiter);
await storage.set(
id(req.user),
id(req.user, kid),
fileStream,
null,
config.max_expire_seconds

4
server/routes/index.js
View file

@ -88,8 +88,8 @@ module.exports = function(app) {
);
app.get(`/api/exists/:id${ID_REGEX}`, require('./exists'));
app.get(`/api/metadata/:id${ID_REGEX}`, auth.hmac, require('./metadata'));
app.get('/api/filelist', auth.fxa, filelist.get);
app.post('/api/filelist', auth.fxa, filelist.post);
app.get('/api/filelist/:id(\\w{16})', auth.fxa, filelist.get);
app.post('/api/filelist/:id(\\w{16})', auth.fxa, filelist.post);
app.post('/api/upload', auth.fxa, require('./upload'));
app.post(`/api/delete/:id${ID_REGEX}`, auth.owner, require('./delete'));
app.post(`/api/password/:id${ID_REGEX}`, auth.owner, require('./password'));